Skip to main content
Agent Identity

IETF · 15 September 2026

AI Identity Management System

draft-ietf-wimse-aims-00

P. Kasselman, J. Lombardo, Y. Rosomakho, B. Campbell, N. Steele, A. Parecki

WG draftDraft — expect changeIdentity + Authn + AuthzAgent-specificField guide

AI Identity Management System (draft-ietf-wimse-aims-00) is WG draft, 15 September 2026. Best current map of 'use this RFC for that agent problem'. Complementary to AAuth: AIMS says compose the old tools; AAuth says the old tools are insufficient for open-world HTTP clients.

ShareLinkedInX

At a glance

Problem
The industry is reinventing agent auth in incompatible silos. This draft does not define a new protocol. It maps existing IETF/OIDF/CNCF work onto agent needs and names the functional gaps.
Identity / authn / authz
A conceptual Agent Identity Management System covering identifiers, credentials, provisioning, authentication, authorization, observability, policy, and compliance. Agents are modeled as workloads that call LLMs and tools.

Actors

  • User or system
  • Agent
  • LLM
  • Tools / resources
  • AIMS components

01

The gap for agents

The industry is reinventing agent auth in incompatible silos. draft-ietf-wimse-aims-00 (15 September 2026) — adopted by the WIMSE WG, replacing individual draft-klrc-aiagent-auth-03 — does not define a new protocol. It maps existing IETF/OIDF/CNCF work onto agent needs and names the functional gaps. Read this before inventing an 'agent auth standard' — it will tell you which existing RFC you are duplicating.

Complementary to AAuth: AIMS says compose the old tools; AAuth says the old tools are insufficient for open-world HTTP clients. Both can be true in different deployments.

02

Actors and trust boundaries

Agents are modeled as workloads that call LLMs and tools. Users/systems are upstream principals. AIMS is a conceptual Agent Identity Management System covering identifiers, credentials, provisioning, authentication, authorization, observability, policy, and compliance — not a wire protocol with its own tokens.

03

Mechanics

Guidance, not endpoints: use WIMSE/SPIFFE for agent-as-workload authentication; use OAuth 2.0 for delegated or autonomous authorization (authorization code for user delegation, client credentials or JWT grants for autonomous agents); use identity chaining across domains; avoid API keys as the primary credential. Authors: P. Kasselman, J. Lombardo, Y. Rosomakho, B. Campbell, N. Steele, A. Parecki. Presented in WIMSE meetings (IETF 126).

04

Step-by-step flows

Flow 1

AIMS decision path (not a wire flow)

  1. 1

    Identify the principal: user, agent instance, workload, resource — separately.

  2. 2

    If the caller is a workload in your systems: WIMSE/SPIFFE (WIT+WPT or mTLS).

  3. 3

    If the call is on behalf of a user: OAuth 2.1 authorization code / CIBA / XAA, audience-restricted, preferably PoP.

  4. 4

    If crossing domains: identity chaining (8693+7523), not a copied access token.

  5. 5

    If inside a domain fan-out: transaction tokens for purpose. Observe and revoke via SSF/CAEP where sessions go stale.

05

Identity vs authentication vs authorization

A map across identity, authentication, and authorization. It does not mint tokens. It tells you which RFC's tokens to use for which agent problem.

06

How it composes

07

What bites agent implementers

  • Treating AIMS as a protocol

    There is no AIMS token type. If a vendor sells 'AIMS-compliant tokens', ask which RFC they mean.

  • API keys anyway

    The draft's point is to stop using API keys as the primary agent credential. If you still ship them, you skipped the BCP.

08

Stability — what you can ship

draft-ietf-wimse-aims-00, 15 September 2026, expires 19 March 2027, WIMSE WG informational. Replaces draft-klrc-aiagent-auth-03. https://datatracker.ietf.org/doc/draft-ietf-wimse-aims/. Use as a reading list, not as a wire spec.

Implementer notes

WIMSE working-group draft as of 15 September 2026 (replaces individual draft-klrc-aiagent-auth-03); still draft-ietf-wimse-aims-00 when re-checked 1 November 2026. Informational BCP-style map — still not a protocol RFC and it still does not mint an 'AIMS token'. Read this before inventing an agent-auth standard; it will tell you which existing RFC you are duplicating.

Related

Specs

Deployment patterns

Primary sources